Sanitation fixes: Dont remove iframes and also sanitize the onload attribute.